How can I add extra mount point(s) under "Disk Usage" panel in Monitoring Console?

[muradgh]

Hi Splunkers,

I want to add some extra mount points in the Monitoring console for reporting purposes.

Currently, I can see only the following:

Looking into the CLI for this instance (client X):

So, I want to add "/opt/splunk-frozendata". (also adding the "/" is a great addition to the list)

What I have done is editing to the "indexes.conf" by adding the following:

[volume:frozenprimary]
path = /opt/splunk-frozendata

After this, I restarted the Splunk machine and went back to the Monitoring console to see if this did the trick, but it didn't.

Going to "Monitoring Console" by clicking on the "Settings" menu, then "Monitoring Console.", then selecting the "Indexes" tab, under the "Indexes and Volumes" I can see the following:

So, for the sake of testing, I went back to the "indexes.conf" and edited:

[volume:frozenprimary]
path = /opt/splunk-frozendata
maxVolumeDataSizeMB = 3670016

After this, I restarted the Splunk machine and went back to the Monitoring console to see what changed, I found the following:

And also nothing changed under the "Disk Usage" panel.

Can someone please help me with this? what am I missing here?

Thanks.

[aleccese]

Hi,

did you manage to solve this?

Thanks!

[muradgh]

A year after, well, better late than never 😆
unfortunately, I didn't found a solution to this case, so I just moved on 😢 

[isoutamo]

Hi

The reason why this isn't working is that spunk didn't manage that volume as you haven't there any hot/warm or cold index spaces. When you have moved buckets into frozen state then splunk didn't count those anyhow. Only thing what is looking with those is that your cold to frozen script will return zero when splunk has called it. If it's not zero then it didn't remove that bucket from cold volume.

If you want to look other space/volumes/fs mountpoints you must use e.g. Splunk Add-on for Unix and Linux | Splunkbase or other inputs which just run df for that.

r. Ismo